SJ77 Posted January 22, 2020 Share Posted January 22, 2020 Hi, I’m using iftop and with this tool it’s pretty easy to see the IP address of the top bandwidth hog. The thing that is surprising to me is that if I take the IP address and go into the ACP, and entered into the IP tools I’m not finding anything associated to this IP address. Not a connection not a user, nothing. which is surprising to me because I’m on a dedicated server and this site is really the only busy site on the server. I guess my question is if this IP address is not on the InVision power site what on earth is it doing and how is it using so much bandwidth on my server? is there anyway to figure out if this is a genuine user doing something they’re supposed to do or possibly an intruder stealing my resources? any next steps to research this or ideas? Link to comment Share on other sites More sharing options...
Adlago Posted January 22, 2020 Share Posted January 22, 2020 This tool collects and displays in addition to the IP of your users and server IPs that have connected an end client to your site. This is probably why you do not receive information about each IP with the IPS IP Tool. You may need to try some other IP tool's controls, for example http://www.iptools.com/ https://www.ultratools.com/tools/ipWhoisLookupResult https://hackertarget.com/ip-tools/ etc. Link to comment Share on other sites More sharing options...
bfarber Posted January 22, 2020 Share Posted January 22, 2020 You can grep through your web server's access logs for the IP address to see exactly what files/URLs they are requesting. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.